Apr 01 05 11:38a 



SVIPG 



408 971 4GG0 



p. 13 



REMARKS 

The Examiner has rejected Claims 3, 17, and 31 (the subject matter of which has now been 
incorporated into each of the independent claims) under 35 U.S. C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. Specifically, the Examiner has deemed applicant's claimed "wherein 
monitoring a peer-to-peer network comprises evaluating a change with respect to shared data on a 
peer in the peer-to-peer network" to be unclear, and has decided to interpret such limitations as 
"evaluating changes in the traffic received from the peer." 

Applicant respectfully disagrees with this interpretation, as it does not take into consideration 
the full weight of applicant's claims. In order to clarify what is being claimed, applicant has clarified 
the language at issue to more clearly claim the instant subject matter. 

The Examiner goes onto interpret applicant's claimed "monitoring a peer-to-peer network" as 
being equivalent to monitoring traffic in both directions on any network. Applicant respectfully 
disagrees with this interpretation, and has clarified the claims to emphasizethe distinction between 
applicant's claims and "monitoring traffic in both directions on any network." 

The Examiner has rejected Claims 1-44 under 35 U.S.C 102(e) as being anticipated by 
Lowell (USPN 6,381,632). The Examiner has further rejected Claims 1-44 under 35 U.S.C. 102(e) 
as being anticipated by Conklin et al. (USPN 5,991 ,881). The Examiner has further rejected Claims 
1-44 under 35 U.S.C. 102(e) as being anticipated by Farley et al. (USPAN 2002/0078381). 
Applicant respectfully disagrees with such rejections, especially in view of the incorporation of the 
subject matter of Claims 3 and 8 et al. (or substantially similar, but not identical, language) into each 
of the independent claims. 

It is noted that the Examiner has only specifically applied the foregoing references to the 
independent claims of the present application. Further, after inspection of the foregoing references, 
there is simply not even a suggestion of at least the following features, now independently claimed: 
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"wherein the peer-to-peer network permits peers to connect and operate substantially 
without a server by utilizing the server, at most, for providing addresses for the peers in the 
peer-to-peer network; 

wherein a pattern of activity is defined in terms of a configuration of shared data on a 
peer, the configuration establishing a baseline of authorized shares and permissions in 
association with the shared data; 

wherein monitoring a peer-to-peer network comprises evaluating a change with 
respect to the shared data on a peer in the peer-to-peer network, the change being made with 
respect to the baseline" (see this or substantially similar, but not identical, language in each of 
the independent claims). 

The Examiner is reminded that a claim is anticipated only if each and every element as set 
forth in the claim is found, either expressly or inherently described in a single prior art reference. 
Verdegaal Bros. v. Union Oil Co. Of California, 814 F.2d 628, 631, 2 USPQ2d 1051, 1053 (Fed. 
Cir. 1987). Moreover, the identical invention must be shown in as complete detail as contained in 
the claim. Richardson v. Suzuki Motor Ca868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 
1989). The elements must be arranged as required by the claim. 

This criterion has simply not been met by any of the foregoing references. A notice of 
allowance or specific prior art showing of each of the foregoing claim elements, in combination with 
the remaining claimed features, is respectfully requested. 

Still yet, the Examiner has further rejected Claims 1-44 under 35 U.S.C. 103(a) as being 
unpatentable over Welch Jr. et al. (USPN 5,862,335) in view of Conklin et al. (USPN 5,991,881). 
Applicant respectfully disagrees with such rejection, especially in view of the incorporation of the 
subject matter of Claims 3 and 8 et al. (or substantially similar, but not identical, language) into each 
of the independent claims. 
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First, it is noted that neither Welch nor Conklin suggest a true "peer-to-peer network," in the 
context claimed. To clarify what is claimed to be a "peer-to-peer network," applicant has clarified 
each of the independent claims, as follows: 

"wherein the peer-to-peer network permits peers to connect and operate substantially 
without a server by utilizing the server, at most, for providing addresses for the peers in the 
peer-to-peer network" (see this or substantially similar, but not identical, language in each of 
the independent claims). 

It is noted, for example, that Welch requires use of a network monitor server for monitoring 
logical connections and file transfers between stations within a computer network, and further 
analyzes both file transfers and logical connections by determining the context of each packet in 
relationship to earlier packets exchanged between two stations (see col. 2, lines 44-52). This clearly 
does not suggest, and even teaches away from, any sort of peer-to-peer network that permits peers to 
connect and operate substantially without a server by utilizing the server, at most for providing 
addresses for the peers in the peer-to-peer network, as claimed by applicant. 

It is further noted that the Examiner has rejected the subject matter of former Claims 3 and 8, 
namely, "wherein a pattern of activity is defined in terms of a configuration of shared data on a 
peer," and "wherein monitoring a peer-to-peer network comprises evaluating a change in shared data 
on a peer in the peer-to-peer network" (now substantially, but not identically incorporated into each 
of the independent claims) in view of the following excerpts from Welch. 

"Briefly described, network monitor 28 monitors logical connections and 
file transfers between stations within computer network 20. Network monitor 
28 analyzes both file transfers and logical connections by determining the 
context of each packet in relationship to earlier packets exchanged between 
two stations. Network monitor 28 uses a network management engine and a 
network management database to perform this function." (see col. 2, lines 
45-55) 

"By analyzing PCI 42 of a packet in conjunction with network management 
database 84, network management engine 82 is able to determine the context 
of a packet. That is, network management engine 82 determines whether the 
packet is of interest and whether it is part of an existing or new 
connection. By doing so, network management engine 82 is able to analyze 
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logical connections and fi]e transfers, not just individual packets. 

Network management engine 82 includes at least one management engine, 
either application management engine (AME) 81 or connection management 
engine (CME ) 83." (see col. 4, lines 45-55) 

Applicant respectfully disagrees with this assertion. Specifically, simply nowhere in the 
foregoing excerpts or the remaining Welch reference is there any sort of pattern of activity being 
defined in terms of a configurat ion of shared data on a peer, or monitoring a peer-to-peer network by 
evaluating a change with respect to shared data on a peer in the peer-to-peer network . 

Nevertheless, despite such deficiencies and in the spirit of expediting the prosecution of the 
present application, applicant has incorporated the following emphasized subject matter into each of* 
the independent claims: 

''wherein a pattern of activity is defined in terms of a configuration of shared data on a 
pee r, the configuration establishing a baseline of authorized shares and permissions in 
association with the shared data ; 

wherein monitoring a peer-to-peer network comprises evaluating a change with 
respect to the shared data on a peer in the peer-to-peer network , the change being made with 
respect to the baseline " (emphasis added - see each of the independent claims). 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there 
must be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine reference 
teachings. Second, there must be a reasonable expectation of success. Finally, the prior art reference 
(or references when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of success must both be 
found in the prior pt and not based on applicant's disclosure. In re Vaeck>947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir. 1991). 
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Applicant respectfully asserts that at least the first and third element of the prima facie case 
of obviousness have not been met. For example, with respect to the third element of the prima facie 
case of obvious, such element has not been met since the prior art references, when combined, fail to 
teach or suggest aH of the claim limitations, as noted above. A notice of allowance or a specific prior 
art showing of all of applicant's claim limitations, in combination with the remaining claim 
elements, is respectfully requested. 

Applicant further notes that the Examiner's application of the prior art to applicant's 
remaining dependent claims is further replete with deficiencies. Just by way of example, the 
Examiner relies on the following excerpt from Conklin to make a prior art showing of applicant's 
claimed "refreshing the set of rules when the set of rules changes" (see Claim 14 et aL). 

"As each packet of network data is passed from the Network Observation 
function, the Intrusion Detection function examines the data in comparison 
to a series of predefined or learned patterns which are pre-stored or 
developed from data received from the network. 

In the preferred embodiment, the network data is compared to a database 
of known patterns, (col. 4, lines 48-52) 

Applicant respectfully disagrees with this assertion. For example, there is simply not even a 
suggestion of refreshing the set of rules when the set of rules changes . A notice of allowance or a 
specific prior art showing of all of applicant's claim limitations, in combination with the remaining 
claim elements, is respectfully requested. 

Still yet, applicant brings the following subject matter in new Claims 45-49 to the Examiner's 
attention for full consideration: 

"wherein a share configuration loop is executed to detect changes to shares and 
corresponding permissions, and take action as a function of a type of the changes" (see Claim 45); 

"wherein the share configuration loop is executed dynamically" (see Claim 46); 
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"wherein the share configuration loop is executed on a schedule shares and corresponding 
permissions, and take action as a function of a type of the changes" (see Claim 47); 

"wherein the share configuration loop examines a current share configuration against a 
previously recorded shared configuration" (see Claim 48); and 

"wherein, if the change includes an attempt to un-share a file or directory, the action includes 
a log entry" (see Claim 49). 

Again, a notice of allowance or a specific prior art showing of all of applicant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Thus, all of the independent claims are deemed allowable. Moreover, the remaining 
dependent claims are further deemed allowable, in view of their dependence on such independent 
claims. 

In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 505-5100. The Commissioner is authorized to charge 
any additional fees or credit any overpayment to Deposit Account No. 50-1351 (Order No. 
NAI1P344). 



P.O. Box 721120 

San Jose, CA 95172-1120 

408-505-5100 




^speatfelly submitted, 
Zilka^tab, PC. 



^inl/Zilka 
fcgistration No. 4 1 ,429 



Docket: NAI1P344/01. 249.01 



-15- 



PAGE 18/18 * RCVO AT 4/1/200$ 2:29:38 PM (Eastern Standard Time] • S VR: USPTO-EFXRF-1/0 • DNJS:8729306 " C$87:408 971 4660 * DURATION <mm-ss):05-42. 



